|
| 1 | +--- |
| 2 | +title: Configuring Azure Activity Log Export |
| 3 | +description: Provides guidance for resolving issues related to configuring the export of Azure activity logs |
| 4 | +ms.date: 10/01/2025 |
| 5 | +author: JarrettRenshaw |
| 6 | +ms.author: jarrettr |
| 7 | +ms.reviewer: v-gsitser, v-ryanberg, neghuman, vikamala |
| 8 | +ms.service: azure-monitor |
| 9 | +ms.custom: I can’t configure export of activity logs |
| 10 | +--- |
| 11 | + |
| 12 | +# Configure Azure activity log export |
| 13 | + |
| 14 | +This article outlines the steps to successfully configure Azure activity log export. This article also provides solutions to common issues that you might experience, especially if you're transitioning from older methods. |
| 15 | + |
| 16 | +## Configuring activity log export |
| 17 | + |
| 18 | +To configure Azure activity log export, follow these steps. |
| 19 | + |
| 20 | +### Step 1: Verify current configuration |
| 21 | + |
| 22 | +1. Go to the [Azure portal](https://ms.portal.azure.com/auth/login/), and access the **Activity Logs** section. |
| 23 | +1. Check the current export settings to make sure that they align with your requirements. |
| 24 | + |
| 25 | +### Step 2: Update legacy methods |
| 26 | + |
| 27 | +1. If you're using legacy APIs, PowerShell commands, or [log profiles](/answers/questions/1851179/what-will-happen-to-the-azure-activity-logs-soluti), update them to use diagnostic settings. |
| 28 | +1. Use the `Get-AzOperationalInsightsDataSource` command to verify existing data sources. |
| 29 | + |
| 30 | +### Step 3: Configure new export settings |
| 31 | + |
| 32 | +1. Select **Activity log** > **Export Activity Logs**. |
| 33 | +1. Find and select the subscription, and then select **Add diagnostic setting**. |
| 34 | +1. In the **Diagnostic setting name** box, enter a name. |
| 35 | +1. Select all applicable categories and then select **Save**. |
| 36 | + |
| 37 | +> [!NOTE] |
| 38 | +> It usually takes about 30 minutes for the export to begin. For more information, see [Time before telemetry gets to destination](/azure/azure-monitor/platform/diagnostic-settings?tabs=portal#time-before-telemetry-gets-to-destination). |
| 39 | +
|
| 40 | +## Common issues and solutions |
| 41 | + |
| 42 | +- **Issue**: Logs aren't appearing in configured destinations. |
| 43 | +- **Solution**: See the following guidance for log analytics, event hubs, and storage accounts. |
| 44 | + |
| 45 | +### For log analytics |
| 46 | + |
| 47 | +1. Navigate to **Log Analytics workspaces**. |
| 48 | +1. Select the workspace and then run the following query: |
| 49 | + |
| 50 | +```powershell |
| 51 | +AzureActivity |
| 52 | +| summarize count() by bin(TimeGenerated,1d) |
| 53 | +``` |
| 54 | + |
| 55 | +This should determine the number of logs per day that are being ingested into this workspace. |
| 56 | + |
| 57 | +### For event hubs |
| 58 | + |
| 59 | +1. Navigate to **Event Hubs**. |
| 60 | +1. Select the event hub and then select **Data Explorer**. |
| 61 | +1. Verify the logs are reaching the event hub. |
| 62 | + |
| 63 | +If the logs aren't reaching the event hub, check for throttling using a metrics blade. |
| 64 | + |
| 65 | +### For storage accounts |
| 66 | + |
| 67 | +1. Navigate to **Storage center | Storage accounts (Blobs)**. |
| 68 | +1. Locate and select the **insights-activity-logs** container. |
| 69 | + |
| 70 | +The logs should be visible. |
| 71 | + |
| 72 | +## Frequently asked questions |
| 73 | + |
| 74 | +**Q1: Why don't the logs appear in the destination?** |
| 75 | + |
| 76 | +**A1:** Make sure that the network is well connected, and verify the permissions for Log Analytics workspace. |
| 77 | + |
| 78 | +**Q2: Why do errors appear in the PowerShell commands?** |
| 79 | + |
| 80 | +**A2:** Make sure that you're using the latest Azure PowerShell module. |
| 81 | + |
| 82 | +## References |
| 83 | + |
| 84 | +- [Azure Monitor documentation](/azure/azure-monitor/fundamentals/overview) |
| 85 | +- [Azure activity logs overview](/azure/azure-monitor/fundamentals/data-sources) |
| 86 | +- [Configure diagnostic settings](/azure/azure-monitor/platform/diagnostic-settings?tabs=portal) |
| 87 | + |
| 88 | +[!INCLUDE [azure-help-support](../../../../includes/azure-help-support.md)] |
0 commit comments